Vehicular communication system

ABSTRACT

An object of the present disclosure is to determine whether or not communication between ECUs after update of a software program is expected communication. A vehicular communication system includes: a storage unit which stores a first piece of information indicating data scheduled to be transmitted and received on a bus connecting a plurality of ECUs so that the ECUs can communicate with one another; an acquiring unit which acquires a second piece of information indicating data being transmitted and received on the bus when a software program of at least one of the plurality of ECUs is updated; and a determining unit which determines whether or not expected communication is being executed on the bus based on the first piece of information and the second piece of information.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to Japanese Patent Application No.2018-019413, filed Feb. 6, 2018, incorporated herein by reference in itsentirety.

BACKGROUND Field

The present disclosure relates to a vehicular communication system.

Description of Related Art

Present-day automobiles are mounted with a plurality of microcomputersreferred to as electronic control units (ECUs) which communicate withone another. In addition, since opportunities for updating softwareprograms used by the ECUs have increased with the dissemination ofdriving assistance technology and autonomous driving technology,techniques for verifying that software programs are updated correctlyhave become important.

For example, Patent Publication JP-A-2015-103163 discloses a programupdate system which executes a computer program that realizes means fordetermining whether or not operations of a control apparatus afterupdate of a control program are normal and which returns a result of thedetermination to a relay apparatus.

SUMMARY

However, when an update of a software program is executed per ECU, ECUsupdated with a latest software program and ECUs not updated with thelatest software program may be created and communication which differsfrom expected communication may be executed among the ECUs. In addition,since recent increases in software programs for update being distributedvia a wireless network have created more cases where update timings ofsoftware programs differ from one ECU to the next, a resolution for thisproblem is much anticipated.

In consideration thereof, an object of embodiments of the presentdisclosure is to provide a vehicular communication system capable ofdetermining whether or not communication between ECUs after update of asoftware program is expected communication.

A vehicular communication system according to an aspect of the presentdisclosure includes: a storage unit which stores a first piece ofinformation indicating data scheduled to be transmitted and received ona bus connecting a plurality of electronic control units (ECUs) so thatthe ECUs can communicate with one another; an acquiring unit whichacquires a second piece of information indicating data being transmittedand received on the bus when a software program of at least one of theplurality of ECUs is updated; and a determining unit which determineswhether or not expected communication is being executed on the bus basedon the first piece of information and the second piece of information.

According to the present disclosure, a vehicular communication systemcapable of determining whether or not communication between ECUs afterupdate of a software program is expected communication can be provided.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram showing an example of a vehicular communicationsystem according to an embodiment;

FIG. 2 is a diagram showing an example of a communication confirmationECU according to the embodiment;

FIG. 3 is a diagram showing an example of a type, an ID, an expectedvalue, and presence/absence of data confirmation of messages stored by acommunication confirmation ECU according to the embodiment;

FIG. 4 is a diagram showing an example of relationships between a type,an ID, an expected value, and presence/absence of data confirmation ofmessages stored by a communication confirmation ECU according to theembodiment and flags corresponding thereto;

FIG. 5 is a sequence diagram showing an example of a process accordingto the embodiment; and

FIG. 6 is a flow chart showing an example of a process by which acommunication confirmation ECU according to the embodiment determineswhether or not expected communication is being executed on a bus.

DETAILED DESCRIPTION

Embodiments will be described with reference to the drawings. It shouldbe noted that, in the diagrams, elements with a same reference numeralhave a same or similar configuration.

A vehicular communication system according to the embodiment will bedescribed with reference to FIGS. 1 to 4. For example, as shown in FIG.1, a vehicular communication system 1 includes a gateway ECU 101, an ECU102, an ECU 103, an ECU 104, an ECU 105, an ECU 106, a vehicular device107, an input/output apparatus 108, a communication confirmation ECU109, and a bus 110. Hereinafter, a case where a software program of theECU 102 is updated will be described as an example. An update of thesoftware program may be executed both when an automobile is stationaryand when the automobile is traveling.

The gateway ECU 101 relays data transmitted and received between the ECU102, the ECU 103, the ECU 104, the ECU 105, or the ECU 106 and an ECUconnected to a bus that differs from the bus 110. The five ECUs controlrespective parts of the automobile such as a brake and a sensor. Thevehicular device 107 is an interface device such as a car navigationdevice or a meter. The input/output apparatus 108 includes an inputapparatus such as a button and an output apparatus such as a display.

For example, as shown in FIG. 2, the communication confirmation ECU 109includes a receiving unit 31, a storage unit 32, a transmitting unit 33,an acquiring unit 34, a determining unit 35, and a setting unit 36. Insome embodiments, the communication confirmation ECU 109 includes atleast the storage unit 32, the acquiring unit 34, and the determiningunit 35, and another apparatus equipped with comparable functions withrespect to at least one of the receiving unit 31, the storage unit 32,the transmitting unit 33, the acquiring unit 34, the determining unit35, and the setting unit 36 may be used. Furthermore, the communicationconfirmation ECU 109 is connected to a server 2 shown in FIG. 1 by awireless network so as to be capable of mutual communication. Moreover,the communication confirmation ECU 109 may be equipped with similarfunctions to the gateway ECU 101. In this case, the vehicularcommunication system 1 does not need to include the gateway ECU 101.

The receiving unit 31 receives information indicating that a softwareprogram has been updated from the ECU 102.

The storage unit 32 is a storage medium storing a first piece ofinformation indicating data scheduled to be transmitted and received onthe bus 110 and is, for example, a random access memory (RAM) or astatic random access memory (SRAM). In this case, the first piece ofinformation is, for example, an expected value of a message scheduled tobe transmitted and received on the bus 110, unnecessary data that doesnot require to be transmitted and received on the bus 110, orparticularly important data transmitted and received on the bus 110.

For example, as shown in FIG. 3, the storage unit 32 stores, inassociation with each other, a type, an ID (Identification), an expectedvalue, and a presence/absence of data confirmation of a messagescheduled to be transmitted and received on the bus 110.

For example, there are four types of messages including a regularlytransmitted control message, an irregularly transmitted control message,a network management message, and an unnecessary message. The twocontrol messages are messages for controlling the respective parts ofthe automobile controlled by the five ECUs shown in FIG. 1. The networkmanagement message is a message for causing the bus 110 to make atransition to a wakeup state or a sleep state. The unnecessary messageis a message which does not need to be transmitted or received on thebus 110 and which is received when, for example, the vehicularcommunication system 1 is subjected to a cyber attack or the ECUs shownin FIG. 1 are erroneously updated by another software program.

The expected value of a regularly transmitted control message is morereadily generated than the expected value of an irregularly transmittedcontrol message. This is because it may not necessarily be easy todetermine whether a case where the irregularly transmitted controlmessage is transmitted is normal or not.

The ID is a character string for identifying a message and is attachedto, for example, the front of the message. The expected value is aphysical quantity indicating characteristics of a message such as aperiodicity or a transmission frequency of the message. Dataconfirmation refers to a process of comparing data stored by the storageunit 32 with data acquired by the acquiring unit 34 as a second piece ofinformation (to be described later) to determine whether or not expectedcommunication is being executed on the bus 110.

For example, as shown in FIG. 3, the control message (regular) with theID “xxx” has an expected value of which the periodicity is 10 msec andthe frequency is 80, and data confirmation is not performed. In asimilar manner, the control message (irregular) with the ID “ppp” has anexpected value of which the frequency is 1, and data confirmation isperformed. In addition, the control message (irregular) with the ID“qqq” has an expected value of which the frequency is 2, and dataconfirmation is not performed. The other messages shown in FIG. 3 may bedescribed in a similar manner. Since an unnecessary message is a messagewhich does not need to be transmitted or received on the bus 110, anexpected value thereof is not stored in the storage unit 32 andpresence/absence of data confirmation is not particularly defined.

In addition, favorably, the first piece of information transmitted andreceived on the bus 110 is stored by the storage unit 32 within aprescribed time after an accessory power supply or an ignition powersupply is turned on. This is because the first piece of informationwithin the prescribed time is often decided in advance and often enablesa determination on whether or not expected communication is beingexecuted on the bus 110 to be made more readily. Furthermore, in orderto generate accurate expected values of all pieces of data transmittedand received on the bus 110, favorably, a length of the prescribed timeis sufficient for generating an expected value of data with a longesttransmission period among the pieces of data. Alternatively, the storageunit 32 may store, one by one, unnecessary messages transmitted andreceived on the bus 110.

The transmitting unit 33 transmits information indicating that storageof the first piece of information has been completed to the server 2. Inaddition, the transmitting unit 33 transmits, to the input/outputapparatus 108, at least one of information indicating that a softwareprogram of the ECU 102 or the like has been updated and informationindicating that a process of determining whether or not expectedcommunication is being executed on the bus 110 is to be started.Furthermore, the transmitting unit 33 transmits information indicatingthat there is no problem with the communication or warning informationindicating that there is a problem with the communication to thevehicular device 107.

When a software program of at least one of the five ECUs shown in FIG. 1is updated, the acquiring unit 34 acquires the second piece ofinformation indicating data being transmitted and received on the bus110. In this case, the second piece of information is, for example, anexpected value of a message being transmitted and received on the bus110, unnecessary data that does not require to be transmitted andreceived on the bus 110, or particularly important data transmitted andreceived on the bus 110. For example, the acquiring unit 34 acquires thesecond piece of information spread as an electric signal on the bus 110directly from the bus 110.

In addition, favorably, the acquiring unit 34 acquires the second pieceof information being transmitted and received on the bus 110 within theprescribed time described earlier. This is because the second piece ofinformation within the prescribed time is often decided in advance andoften enables a determination on whether or not expected communicationis being executed on the bus 110 to be made more readily. Alternatively,the acquiring unit 34 may acquire, one by one, unnecessary messagestransmitted and received on the bus 110.

Based on the first piece of information and the second piece ofinformation, the determining unit 35 determines whether or not expectedcommunication network is being executed on the bus 110. Specifically,when the first piece of information and the second piece of informationare expected values of a message, the determining unit 35 compares thefirst piece of information with the second piece of information, andwhen the two pieces of information differ from each other, thedetermining unit 35 determines that expected communication is not beingexecuted on the bus 110. Alternatively, when the first piece ofinformation and the second piece of information are unnecessary data,the determining unit 35 compares the first piece of information with thesecond piece of information, and when the two pieces of information areequal to each other, the determining unit 35 determines that expectedcommunication is not being executed on the bus 110.

In addition, the determining unit 35 determines whether or not diagnosisregistration is necessary and determines whether or not transmission ofwarning information is necessary. In this case, diagnosis registrationrefers to a process of registering, when unexpected communication isbeing executed on the bus 110 but there is no need to transmit warninginformation, the fact that the communication is executed.

Moreover, the determining unit 35 is capable of executing the threedeterminations described above both when the automobile is stationaryand when the automobile is traveling.

The setting unit 36 sets a flag “0”, a flag “1”, or a flag “2” inaccordance with results of the respective determinations made by thedetermining unit 35 and performs diagnosis registration.

For example, as shown in FIG. 4, when the determining unit 35 determinesthat “periodicity failed”, “frequency failed”, or “unnecessary messagereceived” with respect to the control message (regular) with the ID“xxx” shown in FIGS. 3 and 4, the setting unit 36 sets the flag “0”, butwhen the determining unit 35 determines that “data defective”, thesetting unit 36 sets the flag “1”. In this case, “data defective” meansthat, as a result of the data confirmation shown in FIGS. 3 and 4, adetermination is made that expected communication is not being executedon the bus 110. In a similar manner, when the determining unit 35determines that “periodicity failed”, “data defective”, and “unnecessarymessage received” with respect to the network management message shownin FIGS. 3 and 4, the setting unit 36 sets the flag “2”. The othermessages shown in FIG. 4 may be described in a similar manner.

Next, an example of a process according to the embodiment will bedescribed with reference to FIG. 5.

In step S1, the server 2 transmits a software program for update to theECU 102.

In step S2, the ECU 102 updates the software program.

In step S3, the ECU 102 transmits information indicating that thesoftware program has been updated in step S2 to the server 2.

In step S4, the receiving unit 31 receives the information indicatingthat the software program has been updated in step S2 from the ECU 102.

In step S5, the server 2 transmits a first piece of informationindicating data scheduled to be transmitted and received on the bus 110to the communication confirmation ECU 109.

In step S6, the storage unit 32 stores the first piece of informationindicating data scheduled to be transmitted and received on the bus 110.

In step S7, the transmitting unit 33 transmits information indicatingthat storage of the first piece of information has been completed.

In step S8, the transmitting unit 33 transmits information indicatingthat the software program has been updated in step S2 to theinput/output apparatus 108.

In step S9, the input/output apparatus 108 receives informationindicating that the ignition power supply has been turned on andtransmits the information to the communication confirmation ECU 109 andthe vehicular device 107.

In step S10, the communication confirmation ECU 109 determines whetheror not expected communication is being executed on the bus 110. Detailsof step S10 will be described with reference to FIG. 6.

Alternatively, in step S9, the input/output apparatus 108 may receiveinformation indicating that the accessory power supply instead of theignition power supply has been turned on and may transmit theinformation to the communication confirmation ECU 109 and the vehiculardevice 107.

Next, an example of details of step S10 will be described with referenceto FIG. 6.

In step S101, the transmitting unit 33 transmits, to the input/outputapparatus 108, information indicating that a process of determiningwhether or not expected communication is being performed on the bus 110is to be started, and advances the process to step S102.

In step S102, the acquiring unit 34 acquires the second piece ofinformation indicating data being transmitted and received on the bus110, and advances the process to step S103.

In step S103, the determining unit 35 determines whether or not expectedcommunication is being executed on the bus 110. When the determiningunit 35 determines that the communication is being executed (step S103:Yes), the determining unit 35 advances the process to step S104, butwhen the determining unit 35 determines that the communication is notbeing executed (step S103: No), the determining unit 35 advances theprocess to step S106.

In step S104, the setting unit 36 sets the flag “0” and advances theprocess to step S105.

In step S105, the transmitting unit 33 transmits, to the input/outputapparatus 108, information indicating that there is no problem with thecommunication being performed on the bus 110, and ends the process.

In step S106, the determining unit 35 determines whether or notdiagnosis registration is necessary. When the determining unit 35determines that diagnosis registration is necessary (step S106: Yes),the determining unit 35 advances the process to step S107, but when thedetermining unit 35 determines that diagnosis registration isunnecessary (step S106: No), the determining unit 35 ends the process.

In step S107, the setting unit 36 performs diagnosis registration andadvances the process to step S108.

In step S108, the determining unit 35 determines whether or nottransmission of warning information is necessary. When the determiningunit 35 determines that transmission of warning information is necessary(step S108: Yes), the determining unit 35 advances the process to stepS111, but when the determining unit 35 determines that transmission ofwarning information is unnecessary (step S108: No), the determining unit35 advances the process to step S109.

In step S109, the setting unit 36 sets the flag “1” and advances theprocess to step S110.

In step S110, the transmitting unit 33 transmits, to the input/outputapparatus 108, information indicating that there is no problem with thecommunication being performed on the bus 110, and ends the process.

In step S111, the setting unit 36 sets the flag “2” and advances theprocess to step S112.

In step S112, the transmitting unit 33 transmits warning information tothe input/output apparatus 108 and ends the process.

Alternatively, when the vehicular communication system 1 determines instep S108 that transmission of warning information is unnecessary, thevehicular communication system 1 may end the process without executingsteps S109 and S110.

In addition, when the vehicular communication system 1 determines instep S106 that diagnosis registration is unnecessary, the vehicularcommunication system 1 may execute steps S109 and S110. In this case,for example, the vehicular communication system 1 may end the processafter executing step S105.

An embodiment has been described above. A vehicular communication system1 according to the embodiment includes: a storage unit 32 which stores afirst piece of information indicating data scheduled to be transmittedand received on a bus connecting a plurality of ECUs so that the ECUscan communicate with one another; an acquiring unit 34 which acquires asecond piece of information indicating data being transmitted andreceived on the bus when a software program of at least one of theplurality of ECUs is updated; and a determining unit 35 which determineswhether or not expected communication is being executed on the bus basedon the first piece of information and the second piece of information.Therefore, the vehicular communication system 1 is capable ofdetermining whether or not communication between ECUs after a softwareprogram is updated is expected communication and transmitting a resultof the determination to a user.

The present disclosure is not limited to the embodiment described aboveand can be implemented in various other modes without departing from thegist of the present disclosure. Therefore, the embodiment describedabove is to be considered in all respects as illustrative and notrestrictive. For example, an order in which the respective processingsteps described above are executed can be arbitrarily changed or therespective processing steps may be executed in parallel as long as nocontradictions arise in the contents of processing.

What is claimed is:
 1. A vehicular communication system, comprising: astorage unit which stores a first piece of information indicating datascheduled to be transmitted and received on a bus connecting a pluralityof electronic control units (ECUs) so that the ECUs can communicate withone another, wherein the first piece of information comprises anexpected value of a message scheduled to be transmitted and received onthe bus and a periodicity or frequency of transmission of the message; areceiving unit which receives from at least one of the plurality of ECUsinformation indicating that a software program of the at least one ofthe plurality of ECUs is updated; an acquiring unit which acquires asecond piece of information indicating data being transmitted andreceived on the bus when the receiving unit has received from the atleast one of the plurality of ECUs the information indicating that thesoftware program of the at least one of the plurality of ECUs isupdated; a determining unit which determines whether or not expectedcommunication is being executed on the bus based on the first piece ofinformation and the second piece of information when the receiving unithas received from the at least one of the plurality of ECUs theinformation indicating that the software program of the at least one ofthe plurality of ECUs is updated, and determines whether or not toperform diagnosis registration upon determination that expectedcommunication is not executed on the bus; and a performing unit whichperforms diagnosis registration and transmits warning information to adisplay when the determining unit has determined to perform diagnosisregistration; wherein the receiving unit receives the first piece ofinformation from a server.
 2. The vehicular communication systemaccording to claim 1, wherein the storage unit stores, within aprescribed time after an accessory power supply or an ignition powersupply is turned on, the first piece of information indicating datascheduled to be transmitted and received on the bus, and the acquiringunit acquires the second piece of information being transmitted andreceived on the bus within the prescribed time.
 3. The vehicularcommunication system according to claim 1, wherein the acquiring unitacquires, as the second piece of information, an expected value of amessage being transmitted and received on the bus and a periodicity orfrequency of transmission of the message, and the determining unitcompares the first piece of information with the second piece ofinformation and, when the pieces of information differ from each other,determines that expected communication is not being executed on the bus.4. The vehicular communication system according to claim 1, wherein thestorage unit stores, as the first piece of information, unnecessary datathat does not need to be transmitted and received on the bus, theacquiring unit acquires the unnecessary data as the second piece ofinformation, and the determining unit compares the first piece ofinformation with the second piece of information and, when the pieces ofinformation are equal to each other, determines that expectedcommunication is not being executed on the bus.
 5. A vehicularcommunication system, comprising: a receiving unit which receives from aserver a first piece of information indicating data scheduled to betransmitted and received on a bus connecting a plurality of electroniccontrol units (ECUs) so that the ECUs can communicate with one another,wherein the first piece of information comprises an expected value of amessage scheduled to be transmitted and received on the bus and aperiodicity or frequency of transmission of the message; a storage unitwhich stores the first piece of information; an acquiring unit whichacquires a second piece of information indicating data being transmittedand received on the bus when a software program of at least one of theplurality of ECUs is updated; a determining unit which determineswhether or not expected communication is being executed on the bus basedon the first piece of information and the second piece of information,and determines whether or not to perform diagnosis registration when thefirst determining unit has determined that expected communication is notexecuted on the bus; and a performing unit which performs diagnosisregistration and transmits warning information to a display when thedetermining unit has determined to perform diagnosis registration. 6.The vehicular communication system according to claim 5, wherein thestorage unit stores, within a prescribed time after an accessory powersupply or an ignition power supply is turned on, the first piece ofinformation indicating data scheduled to be transmitted and received onthe bus, and the acquiring unit acquires the second piece of informationbeing transmitted and received on the bus within the prescribed time. 7.The vehicular communication system according to claim 5, wherein theacquiring unit acquires, as the second piece of information, an expectedvalue of a message being transmitted and received on the bus and aperiodicity or frequency of transmission of the message, and thedetermining unit compares the first piece of information with the secondpiece of information and, when the pieces of information differ fromeach other, determines that expected communication is not being executedon the bus.
 8. The vehicular communication system according to claim 5,wherein the storage unit stores, as the first piece of information,unnecessary data that does not need to be transmitted and received onthe bus, the acquiring unit acquires the unnecessary data as the secondpiece of information, and the determining unit compares the first pieceof information with the second piece of information and, when the piecesof information are equal to each other, determines that expectedcommunication is not being executed on the bus.